Privacy Policy
Veridia is a demand-side advertising platform. We help advertisers and their agencies buy advertising space on websites through real-time auctions. This policy explains what personal data we process when you see an advertisement we have bought, when you visit this website, or when you deal with us as a customer, partner or candidate; why we process it; how long we keep it; and how you can exercise your rights.
We designed our platform around a simple rule: we only recognise you across websites if you have said yes. Without your consent, we buy advertising based on the page you are reading, not on who you are.
- Who we are
- Advertising on other websites
- How consent works (TCF)
- What happens without consent
- Cookies and identifiers we set
- How long we keep data
- Who receives data, and where
- This website
- Customers, partners and candidates
- Your rights
- Children
- Automated decisions
- Changes
1. Who we are
SYKKER, a French société par actions simplifiée unipersonnelle registered with the RCS of CRETEIL under number 943 628 354 ("Veridia", "we").
Veridia is the data controller for the processing described in this policy, except where stated otherwise in section 9. We have appointed a Data Protection Officer, declared to the CNIL. You can reach the DPO at dpo@veridiaeu.com.
2. Advertising on other websites
When a publisher's website has advertising space to fill, its supply partner sends a "bid request" to demand platforms such as Veridia. The request describes the page, the ad slot and, depending on your choices, some information about your device. We decide within milliseconds whether to bid for that space on behalf of one of our advertiser clients.
Data we may receive in a bid request
| Category | Examples |
|---|---|
| Page context | Site domain, page category, ad slot size and position, language |
| Device and browser | Browser type and version, operating system, screen size, device class |
| Network | IP address — used for approximate location and fraud detection, then shortened (see section 6) |
| Identifier | A pseudonymous identifier stored in a cookie — only if you have consented (section 3) |
| Consent signal | The TCF "TC string" that records your choices on the publisher's site |
Purposes and legal bases
The table below uses the standardised purpose definitions of the TCF, which is how your choices are presented to you on publishers' websites.
| What we do | TCF purpose | Legal basis |
|---|---|---|
| Store and read a pseudonymous identifier on your device | Purpose 1 | Consent |
| Select and deliver a basic advertisement | Purpose 2 | Consent |
| Build an advertising profile (e.g. frequency capping, interest segments) and select personalised advertisements | Purposes 3 and 4 | Consent |
| Measure whether advertisements were delivered, viewed or clicked | Purpose 7 | Consent |
| Produce aggregated audience and market research for our clients | Purpose 9 | Consent |
| Develop and improve our platform (e.g. bidding models) | Purpose 10 | Consent |
| Ensure security, prevent fraud and invalid traffic, and technically deliver advertisements | Special Purposes 1 and 2 | Legitimate interest (see our legitimate interest statement) |
We do not rely on legitimate interest for any advertising purpose. We do not use special categories of data (health, religion, politics, sexual orientation and similar), and we do not build segments that would reveal them.
3. How consent works (TCF)
Publishers in the European Economic Area ask for your choices through a consent management platform. Your choices are encoded in a TC string that travels with each bid request. On every request we receive, our systems check whether that string shows that you have consented to Veridia specifically for Purposes 1, 3 and 4. Only then do we read or write an identifier for you.
You can change or withdraw your consent at any time through the privacy settings of the website you are visiting. Withdrawal takes effect for subsequent requests; it does not make earlier processing unlawful.
For each advertisement we buy on the consented path, we keep a record of the consent signal (the TC string, a timestamp and a request reference) so that we can demonstrate that the processing was authorised.
4. What happens without consent
If the consent signal is missing, invalid, or does not include Veridia for the required purposes, your request is handled on our contextual path. On that path we:
- do not read or write any cookie or identifier for you;
- do not look up or store any profile;
- do not exchange identifiers with other companies ("cookie syncing");
- use your IP address only to determine an approximate location and to detect invalid traffic, then shorten it before it is stored;
- limit frequency capping to the current browsing session.
We may still show you an advertisement chosen on the basis of the page you are reading. This involves no recognition of you across sites and no profiling.
5. Cookies and identifiers we set
All cookies below are set on the domain t.veridiaeu.com. The same list is published in machine-readable form for consent management platforms at the disclosure URL in section 1.
| Name | Purpose | Lifetime | Set when |
|---|---|---|---|
vid | Pseudonymous identifier for frequency capping, ad selection, measurement and invalid-traffic detection | 13 months, not extended on visits | Only with consent for Purposes 1, 3 and 4 |
vsess | Session-only frequency capping and technical delivery | Until the browser closes | Contextual path |
voptout | Records that you opted out of Veridia personalised advertising | 13 months | When you use the opt-out link below |
Whatever your consent choices, you can also set a Veridia-wide opt-out: t.veridiaeu.com/optout. Note that the opt-out itself relies on a cookie; if you clear cookies, you will need to opt out again.
6. How long we keep data
| Data | Retention |
|---|---|
| Profile data linked to your identifier (frequency counts, segments) | 30 days rolling, 90 days maximum |
| Bid, win, impression, click and conversion events with a pseudonymous identifier | 13 months at most, then aggregated only |
| Sampled bid requests (pseudonymised), for engineering and fraud analysis | 90 days |
| Full IP address | Not stored. Shortened at ingress (last octet removed for IPv4, last 80 bits for IPv6). A full address may be retained for 30 days only when a specific fraud investigation is open. |
| Consent records | For the statutory limitation period, typically 5 years |
| Aggregated statistics (no individual can be identified) | Indefinitely |
These periods are enforced technically: expiry is built into our databases, not applied by hand.
7. Who receives data, and where
All personal data processed by our platform stays in the European Union. Our hosting, analytics, email and support providers are EU-incorporated and EU-hosted. We make no transfers to countries outside the EEA and therefore rely on no transfer mechanisms such as standard contractual clauses.
Recipients fall into three groups:
- Supply partners (advertising exchanges) that send us bid requests and receive our bids. They act as independent controllers under their own privacy policies.
- Our advertiser clients, who receive aggregated campaign reports only. They never receive your identifier or browsing history from us.
- Our processors, who host and support our infrastructure under written data-processing agreements. The current list is published at veridiaeu.com/subprocessors.
We may also disclose data where the law requires it, for example to a court or a supervisory authority.
8. This website
When you visit veridiaeu.com we process server logs (shortened IP address, requested page, browser type, timestamp) for security and troubleshooting, on the basis of our legitimate interest in keeping the site running safely. Logs are kept for [30] days.
9. Customers, partners and candidates
Customers and prospects. We process the business contact details of people at advertisers, agencies and partners (name, role, work email and phone, correspondence) to negotiate and perform contracts, to invoice, and to send relevant information about our services. Legal bases: performance of a contract, legal obligations (accounting records are kept for 10 years under French law), and our legitimate interest in developing business relationships. You may object to prospecting at any time.
Advertiser first-party data. Where a client provides its own customer data for a campaign, Veridia processes it as a processor on the client's instructions under a data-processing agreement. Requests concerning such data should be addressed to the client, who is the controller; we will assist them in responding.
Candidates. Application data is used only for recruitment, on the basis of pre-contractual steps and our legitimate interest in hiring. Unsuccessful applications are deleted after [2] years unless you ask us to delete them sooner.
10. Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You may also define instructions for the handling of your data after your death (French Data Protection Act, art. 85).
To exercise these rights, write to dpo@veridiaeu.com. We respond within one month. Because we never hold your name or email in our advertising systems, we identify you there by the pseudonymous identifier in the vid cookie; our request form explains how to read and send it. We may ask for additional information where needed to confirm that a request relates to your identifier.
For advertising processing based on consent, the simplest way to stop it is to change your choices in the publisher's privacy settings or to use our opt-out link. You can object to processing based on legitimate interest (Special Purposes 1 and 2); we will stop unless we can show compelling grounds, which is typically the case for fraud prevention and security.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL (cnil.fr, 3 place de Fontenoy, 75007 Paris) or with the supervisory authority of your country of residence.
11. Children
Our platform is not directed at children. We do not build profiles of, or personalise advertising to, users we know or reasonably believe to be minors, in line with the Digital Services Act. Where a publisher flags inventory as directed at children, we handle requests on the contextual path only.
12. Automated decisions
Deciding whether and how much to bid for an ad slot is automated. This decision determines only which advertisement, if any, you see in a given slot; it produces no legal or similarly significant effect on you, so Article 22 GDPR does not apply. We do not use automated decision-making for any other purpose concerning you.
13. Changes
We will update this policy when our processing changes and will show the version and effective date at the top. Material changes to the advertising processing are reflected in our TCF vendor registration, which consent management platforms use to present up-to-date information to you.